Gv Eye
Monthly
GV-Eye V3.6.0 transmits a sensitive key as a URL parameter over unencrypted HTTP, so the key travels across the network in cleartext and can be captured by anyone positioned to observe that traffic. With AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, the impact is a high-confidence confidentiality loss with no integrity or availability effect - the assessed vector differs from the reported 7.5 score only in attack complexity (High instead of Low), because exploitation requires an on-path/man-in-the-middle vantage point rather than a directly reachable server-side trigger. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a context-limited confidentiality weakness rather than an actively exploited emergency; the EPSS-derived urgency is not elevated by any confirmed exploitation signal in the supplied data.
A hardcoded API key ships inside the GeoVision GV-Eye Android application (V3.6.0) and can be recovered by reverse engineering the publicly distributed APK, allowing anyone who extracts it to invoke whatever GeoVision backend API operations that key authorizes. The impact is confidentiality-only (C:H, I:N, A:N) scoped to a single embedded credential, and the independent assessment scores it as a local-vector issue (AV:L) because the attacker must first obtain and analyze the client package. No public exploit code identified at time of analysis, and the CVE is not listed in CISA KEV; the practical damage ceiling depends on whether GeoVision rotates or revokes the leaked key on the server side.
Hardcoded API key exposure in the GeoVision GV-Eye Android application (V3.6.0) allows unauthenticated remote attackers to extract the key from the publicly distributable APK via reverse engineering and use it to access backend or third-party services, resulting in high confidentiality impact. With a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-798 classification, the vulnerability requires no user interaction or special privileges, though the actual blast radius is limited by the permissions associated with the single exposed key. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
GV-Eye V3.6.0 transmits a sensitive key as a URL parameter over unencrypted HTTP, so the key travels across the network in cleartext and can be captured by anyone positioned to observe that traffic. With AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, the impact is a high-confidence confidentiality loss with no integrity or availability effect - the assessed vector differs from the reported 7.5 score only in attack complexity (High instead of Low), because exploitation requires an on-path/man-in-the-middle vantage point rather than a directly reachable server-side trigger. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a context-limited confidentiality weakness rather than an actively exploited emergency; the EPSS-derived urgency is not elevated by any confirmed exploitation signal in the supplied data.
A hardcoded API key ships inside the GeoVision GV-Eye Android application (V3.6.0) and can be recovered by reverse engineering the publicly distributed APK, allowing anyone who extracts it to invoke whatever GeoVision backend API operations that key authorizes. The impact is confidentiality-only (C:H, I:N, A:N) scoped to a single embedded credential, and the independent assessment scores it as a local-vector issue (AV:L) because the attacker must first obtain and analyze the client package. No public exploit code identified at time of analysis, and the CVE is not listed in CISA KEV; the practical damage ceiling depends on whether GeoVision rotates or revokes the leaked key on the server side.
Hardcoded API key exposure in the GeoVision GV-Eye Android application (V3.6.0) allows unauthenticated remote attackers to extract the key from the publicly distributable APK via reverse engineering and use it to access backend or third-party services, resulting in high confidentiality impact. With a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-798 classification, the vulnerability requires no user interaction or special privileges, though the actual blast radius is limited by the permissions associated with the single exposed key. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.